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Voting systems used in technical and tactical decision making in pattern recognition and target 
detection, data handling, signal processing, distributed and secure computing etc. are considered. A 
maxmin two period game is analyzed where the defender first protects and chooses units for 
participation in voting. The attacker thereafter attacks a subset of units. It is shown that when the 
defender protects all the voting units, the optimal number of units chosen for voting is either one or 
the maximal possible odd number. When the defender protects only the units chosen for voting, the 
optimal number of chosen units increases with the defender resource superiority (i.e., more resources 
than the attacker) and with probability of providing correct output by any unit. The system success 
probability always increases in the total number of voting units, the defender—attacker resource ratio, 
and the probability that each voting unit produces a correct output. The system success probability 
increases in the attacker-defender contest intensity if the defender achieves per-unit resource 
superiority, and otherwise decreases in the contest intensity. The presented model and enumerative 
algorithm allow obtaining optimal voting system defense strategy for any combination of parameters: 


total number of units, attack and defense resources, unit success probability and contest intensity. 


© 2012 Elsevier Ltd. All rights reserved. 


1. Introduction 


Voting systems (VS) are widely used in technical decision 
making systems. The applications of VS can be found in data 
handling [1-4], safety monitoring and self-testing [5], multi- 
channel signal processing [6], fault tolerant and secure computing 
[7,8], distributed computing [9,10], pattern recognition and target 
detection [11], etc. Several algorithms for VS reliability analysis 
and optimization have been suggested during the last two 
decades [11-21]. 

AVS consists of k voting units producing independent outputs. 
The entire VS makes a decision if N out of k outputs match. For 
majority voting N = [(k+1)/2]. 

When a VS operates in a hostile environment and the success 
of a mission depends on decisions obtained by the VS, the 
malicious counterpart tries to cause incorrect VS decisions by 
attacking individual voting units and compromising them (exam- 
ples of such attacks are virus attacks in computer systems, 
jamming of radio location stations of anti-aircraft defense sys- 
tems, camouflaging targets in battle conditions, etc). Only a few 
works were devoted to analysis of VS operating in hostile 
conditions: [20] considers reliability weighted VSs with limited 
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availability of voting units, that can be totally destroyed by a 
corrosive medium or intentional attacks; [21] considers voting 
unit separation as a measure of VS defense against an attack; [22] 
first considers strategic behavior of the attacker who chooses the 
optimal number of VSs to attack and analyzes the defender’s 
choice of units participating in the voting. In [22] it was assumed 
that the attacker compromises a fixed number of units and that 
this number does not depend on the units’ protection and attack 
intensity. To make the model more realistic this paper considers 
the situation when any attacked voting unit can be compromised 
with a certain probability that depends on protection and attack 
resources applied to the unit. We assume that the attacker can 
select the number of units to attack for minimizing the prob- 
ability that the VS makes a correct decision. The defender can 
freely choose the number of units that participates in the decision 
making and maximizes the VS success probability. Both actors 
have limited resources that are evenly distributed among the 
attacked (protected) units. The assumption about even resource 
distribution is relevant when all the voting units are identical and 
neither the defender nor the attacker have any preferences in 
defending/attacking any specific unit. Another situation when this 
assumption is relevant is when the defense and attack actions 
cannot be aimed at specific units, but affect all units simulta- 
neously (consider, for example a low precision missile attack that 
can hit any unit with the same probability and an anti-missile 
defense system that reduces this probability for any unit). 
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Nomenclature 

Tt attacker’s and defender’s per-unit resource 

R attacker’s resource 

r defender’s per-unit protection resource 

p resource ratio p=r/R 

s total number of voting units 

n number of attacked voting units 

e number of protected voting units 

J number of voting units compromised by the attacker 
k number of units chosen for participation in voting 
WwW system success probability 

k value of k that maximizes W 


f number of units participating in voting and producing 


n value of n that minimizes W 


correct output 
m attacker-defender contest intensity 


(ki) — probability that the defender chooses i compromised 
units for participation in voting 

q(nj) conditional probability that the attacker succeeds to 
compromise exactly j units given it attacks n 

Dp probability that voting unit produces correct output 

v vulnerability (compromising probability) of each 
attacked unit 

[Zz] the greatest integer that does not exceed z 

[Z] the least integer that is not less than z 


Section 2 presents the model. Section 3 illustrates the model 
considering analytically the simplest case of two voting units. 
Section 4 analyzes the optimal defense strategies when all voting 
units are protected and when only units chosen to participate in 
voting are protected. Section 5 concludes. 


2. The model 


Assumptions. 


— 


. All voting units are identical and independent. 

2. The voting units always produce an output (correct with 
probability p and incorrect with probability 1—p). 

3. The defender analyzes signals from k out of s voting units 
choosing these units at random. 

4. The system succeeds if at least [(k+1)/2| from k units chosen 
by the defender produce correct output. 

5. The defender protects either all units, or protects the units 
chosen for voting participation, and evenly distributes its 
protection resource among the protected units. 

6. The attacker chooses at random n units and evenly distributes 
the attack resource among the chosen units. 

7. If an attack against a unit succeeds, the unit is compromised. 
The compromised unit always produces an incorrect output. 

8. The attacker cannot distinguish protected and unprotected 
units. 

9. The defender cannot distinguish compromised and uncompro- 

mised units. 


We consider a voting system consisting of s units. The defender 
distributes the protection resource r evenly among e units achieving 
the per-unit protection resource t=1r/e. We distinguish two different 
situations: e=s, i.e., the defender protects all s units (relevant when 
the protection is an inherent property of the units, when the 
protection is costless, and when it is technically impossible to protect 
only a subset of the units) and e=k, i.e. only k units chosen for 
voting are protected (relevant when units can be protected indivi- 
dually and the protection resource is limited). 

The attacker randomly chooses n units to attack and distri- 
butes its resource R evenly across the n attacked units concen- 
trating the resource T=R/n on each attacked unit. The 
vulnerability (probability of being successfully compromised by 
the attacker) of each attacked unit is determined by the contest 
success function [23,24] 


i i 1 1 
T™+t™ ~~ 1+(nr/(eR))" — 1+(pn/e)™ 


v(n,e) = (1) 


where 6v/0T>0, dv/dt<0, and m=O is a parameter that 
expresses the intensity of the contest. If the attacker exerts high 
effort, it is likely to win the contest which gives high vulner- 
ability. If the defender exerts high effort, it is likely to win the 
contest which gives low vulnerability. When m=O, the efforts t 
and T have no impact on the vulnerability regardless of their size 
which gives vulnerability v=0.5. O<m<1 gives a dispropor- 
tional advantage of investing less than one’s opponent. When m= 1, 
the investments have proportional impact on the vulnerability. m > 1 
gives a disproportional advantage of investing more effort than one’s 
opponent (economies of scale). Finally, m=oo gives a step function 
where “winner-takes-all”. 

The defender cannot recognize the compromised units and 
chooses k out of s units at random to analyze their output. If at 
least [(k+1)/2] units produce the correct output the voting 
system succeeds. 

When the attacker attacks n units, the number of units it 
succeeds to compromise can vary from 0 to n. The conditional 
probability that the attacker succeeds to compromise exactly j 
units given it attacks n units is 


q(n,j) = (7) vd—vy"t (2) 
Ss 
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Fig. 1. Numbers of voting units s, attacked units n, compromised units j, units 
chosen by the defender for participation in the voting k, and number of 
compromised units chosen by the defender i. 


Table 1 
The system success probability W as a function of n and k for e=s=2. 


e=s 
k=1, e=2 k=2, e=2 
n=1 [1—0.5(1+(p/2)")~ "Ip [1—(1+(p/2)")~ "Ip? 
n=2 [1-(1+p™)""lp [1—-(1+p™)" "Pp? 
e=k 
k=1,e=1 k=2, e=2 
n=1 [1-0.5(1+p™)~"]p [1—(1+(p/2)")~ "Ip? 
n=2 [1-(1+(2p)")" "Ip [1-(1+p™)"'Pp? 
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For any given k, if the number of uncompromised units s—j is 
less than {(k+1)/2], the system always fails. Thus, the system can 
succeed only if j <s—|(k+1)/2]. 

When the defender randomly chooses k out of s units (j from 
which are compromised), the number of choosen compromised 
units i can vary from max{0,k—s+j} to minf{j,k} (see Fig. 1). 
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Fig. 2. W as a function of p for p=0.8, m=2, s=2 and different n, k and e. 
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The probability @(k,i) that the defender chooses exactly i 
compromised units is 


i\,/s 
(i) (3) 
: 

(1) 
The number of choosen uncompromised units is k—i. If 
k-i< [(k+1)/2], the voting system fails as the defender cannot 
get [(k+1)/2] correct outputs. If k—-i>[(k+1)/2], ie, 
i<[(k—1)/2], the system succeeds if the number of correct 


outputs f obtained from k-—i voting units is greater than 
[(k+1)/2]. The probability of such an event is 


{kD = (3) 


k-i k—-i as 
> f p'(1-p) (4) 


f = [(k+1)/2] 


The total probability of the voting system success given n units 
are attacked and k units are choosen by the defender is 


min{n,s—[(k+1)/2]} 


wank) = > 


j=0 


min{ [(kK-1)/2] J} 


qnj) >> 


i= max{0,k-s+j} 
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Fig. 3. Switching point p'/s as a function of p for different s and m. 
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inf [19/21 J} (;) () 
oT 3 YANG) \ ki 
‘ : S 
i= max{0,k—s +i} 
(| ) 


k-i k-i-f 
x dl, jPa-p (5) 


f = [(k+1)/2] 


xv(n,ey(1—v(n,e))"7 


The model has two free choice variables n, 1<n<s, and k, 
1<k<s, and four parameters: s, p, m, 1/R.. We consider a two-period 
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Fig. 4. n’ and the corresponding values of W(k,n’) as functions of k for m=2, s=20, 
p=0.9, p=1.5 W(k,n’) is presented separately for odd and even k. 
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game in which the defender moves first protecting the units and 
choosing a subset of units that participate in voting. Thereafter, in 
period 2, the attacker attacks the voting system. The voting based 
decision making is accomplished after the attack. The attacker 
chooses n without observing k. When the defender chooses its 
strategy k it anticipates the worst case scenario assuming that the 
attacker chooses/guesses the most harmful value of n. Thus, the 
defender solves the maxmin problem max min W (n,k). 


3. The simplest case 


Consider a simplest case when s=2. The defender can choose 
either k=1 or k=2. In the first case the defender accepts the 
output of a randomly chosen unit, in the second case the defender 
accepts the units’ output only if they match. The attacker can 
attack either a randomly choosen single unit (1=1) or both units 
(n=2). According to (1), in the first case the attacked unit is 
compromised with probability v(1,e)=1/(1+ (p/e)”), in the sec- 
ond case each attacked unit is compromised with probability 
v(2,e) = 1/(1+ (2p/e)”). Further we consider four different com- 
binations of n and k. 

n=1,k=1: 

The probability that the attacker succeeds to compromise the 
attacked units is v(1,e). The probability that the defender chooses 
the uncompromised unit given one unit is compromised is 0.5. 
Thus, the probability that the one unit is compromised, but the 
analyzed unit is uncompromised is 0.5v(1,e). The probability that 
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Fig. 5. n’, k’ and the corresponding values of W(k’,n’) as functions of p and p for m=2, s=20. 
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the attacker fails to compromise the attacked unit is (1 —v(2,e)). In 
this case any choosen unit is uncompromised. The total prob- 
ability that the defender chooses the uncompromised unit is 
0.5v(1,e)+(1—v(1,e)) and the probability of system success is 


W(1,1) =[0.5v(1,e)+(1 —v(1,e))]p = [1—0.5v(1,e)]p. 


n=1, k=2: 


The probability that the attacker fails to compromise the 
attacked unit is (1—v(1,e)). The system succeeds if both units 
remain uncompromised and produce correct outputs. The prob- 
ability of such an event is 


W(1,2) =[1-v(1,e)]p?. 


n=2,k=1: 


The probability that the attacker succeeds to compromise one 
out of two attacked units is 2v(2,e)(1—v(2,e)). The probability 
that the defender chooses the uncompromised unit given one unit 
is compromised is 0.5. Thus, the probability that the one unit is 
compromised, but the analyzed unit is uncompromised is 
v(2,e)(1 —v(2,e)). The probability that the attacker fails to com- 
promise any unit is (1—v(2,e))*. In this case any choosen unit is 
uncompromised. The total probability that the defender chooses 
the uncompromised unit is v(2,e)(1 —v(2,e))+(1 —v(2,e))* and the 
probability of system success is 


W(2,1) = [v(2,e)(1—v(2,e)) +(1 —v(2, e))* Ip = [1—v(2, e) Jp. 


7 ee 


n=2,k=2: 


The probability that the attacker fails to compromise both 
attacked units is (1—v(2,e))*. The system succeeds if both units 
remain uncompromised and produce correct outputs. The 
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Fig. 7. W(k’,n) as functions of p and m for p=0.1, s=5. 
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Fig. 6. n’, k’ and the corresponding values of W(k’,n’) as functions of p and m for p=1.5, s=20. 
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Fig. 8. n’, k’ and the corresponding values of W(k’,n’) as functions of p and m for p=0.8, s=5. 


probability of such an event is 
W(2,2) =[1—v(2,e)|*p?. 


The obtained results are summarized in Table 1. 

It can be seen from Table 1 that for s=2, k=1 always provides 
greater W than k=2. 

Fig. 2 presents W as a function of p for p=0.8, m=2, s=2 and 
different n, k and e. The success probability W decreases in k, has a 
mixed dependence on n, and intuitively increases in p. 

It can be seen that the optimal value of k is always odd. Indeed, 
when k is even, the system succeeds if [(k+1)/2] =k/2+1 outputs 
are correct. The same number of correct outputs is needed for the 
system success if k+1 units participate in voting. The number of 
successful combinations when at least k/2+1 outputs out of k+1 
are correct is always greater than the number of combinations 
when at least k/2+1 outputs out of k are correct. Therefore 
choosing an odd number of units is always better for the defender. 


4. Analyzing the optimal strategies 
4.1. Enumerative algorithm for finding the maxmin solution 
The solution of the maxmin game (optimal values of n and k 


and corresponding value of the system success probability 
W' =W(n ,k’)) is obtained by the following enumerative procedure. 


1 Assign W’=0 
2 For each k=1.,...,5 
2.1 Assign Wmin= co 
2.2 For each n=1.,...,5 
2.1.1 Determine W(n,k) according to (5) 
2.1.2 If Win > W(n,k) assign Warin=W(n,k) and nnin=n 
2.3 If Wmin > W assign W =Wpin 1 =Mmin, kK =k. 


The total number of strategy combinations checked by the 
algorithm above is s?. 


4.2. All units are protected: e=s 


When all s voting units are protected, the function W(k,n (k)) is 
always monotonic for odd k.' Therefore, the values of k’ corre- 
sponding to maxmin W solutions always belong to the set 
{1, s—1+mody3s}. Let p’ be the switching point such that k=1 
for p<p and k =s—1+modgs for p>’. Fig. 3 presents p' as a 
function of p for different s and m. 

Fig. 3 shows that p’ decreases in s, p, and m. First, more voting 
units s cause the defender to choose only one unit for participation 
for a lower resource ratio p. Conversely, with more resources, the 
defender is more likely to choose k=s— 1+modgs. Second, a higher 


' We have not succeeded proving this analytically, but numerical testing 
suggests that this is the case. 
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Fig. 9. n’, k’ and the corresponding values of W(k',n’) as functions of p and s for p=0.8, m=2. 


probability p that a voting unit produces a correct output causes 
the defender to choose only one unit for participation for a lower 
resource ratio p. With more resources, k=s—1-+mod2s is more 
likely. Third, a higher contest intensity m causes the defender to 
choose only one unit for participation for a lower resource ratio p. 


4.3. Only units chosen for voting are protected: e=k 


When only k units chosen for participation in voting are pro- 
tected, the optimal defender’s strategy k can take any odd value 
from 1 to s. Fig. 4 presents the best response values of n and the 
corresponding values of W(k,n') as functions of k for m=2, s=20, 
p=0.9, p=1.5. It can be seen that W(k,n (k)) has maximum at k=9. 

Fig. 5 plots n, k and the corresponding values of W(k,n’) as 
functions of p and p for m=2, s=20. The number k’ of units 
chosen for participation in voting increases in the resource ratio 
p, and increases in the probability p that each voting unit 
produces correct output. That is, increasing the number of 
analyzed units is effective only if the units produce the correct 
output. The number n’ of attacked units decreases in p and 
increases in p. The success probability W(k,n) intuitively 
increases in p and p since the defender benefits from more 
resources and more reliable units. 

Fig. 6 plots n, k and W(k,n’) as functions of p and m for 
p=1.5, s=20. W(kn’) and k increase in m since, when both 
resource ratio p and the number of units s are high, the defender 
enjoys the per-unit resource superiority (i.e., allocates more 


resources per unit than the attacker), and n’ decreases in m. The 
dependence on p is as in Fig. 5. 

When p and s are low, the defender achieves the per-unit 
resource superiority and benefits from increase of contest inten- 
sity m. Fig. 7 plots W(k’,n) as a function of p and m for p=0.1, 
s=5. It can be seen that W(k ,n’) decreases with m. For any p and 
m, k=1,n =s=5. 

Fig. 8 plots n, k and W(k,n) as functions of p and m for 
p=0.8, s=5. k increases in p and m, while n’ is constant or 
decreases in p and m. W(k,n’) always increases in p, but can 
decrease with m when op is low and the defender has per-unit 
resource superiority and increase with m when op is high and the 
attacker has per-unit resource superiority. 

Fig. 9 plots n, k’ and W(k,n’) as functions of p and s for 
p=0.8, m=2. k and W(k’,n’) increase in p and s, and n 
decreases in p and s. W(k ,n) always increases in s. Indeed, 
for any s the defender can always choose the same k and gets 
the same voting success probability, whereas the probability 
that the units chosen for voting are compromised by the 
attacker decreases with s. 


5. Conclusions 


We analyzed voting systems used in technical and tactical 
decision making in pattern recognition and target detection, data 
handling, signal processing, distributed and secure computing etc. 
When a voting system acts in battle conditions against a strategic 
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counterpart, the voting units can be compromised by intentional 
attacks. Having limited resources the attacker minimizes the 
system success probability by choosing the number of attacked 
units and distributing the attack resource among them. The 
defender can maximize the system success probability by chosing 
the number of voting units that will participate in voting. We 
consider the maxmin two period game in which the defender first 
protects the voting units (either all or only those chosen for 
participation in voting) and the attacker thereafter attacks the 
chosen number of randomly selected units being unable to 
distinguish protected and unprotected units. It is assumed that 
the probability of attack success (which means compromising a 
unit) is a function of the per-unit effort ratio depending on the 
contest intensity ratio. 

We found that when the defender protects all the voting units, 
the optimal number of units chosen for voting is either one or the 
maximal possible odd number. It was shown for which combina- 
tions of parameters the minimal or maximal number of chosen 
units is preferable. 

When the defender protects only the units chosen for voting, 
the optimal number of chosen units increases with the defender 
resource superiority and with the probability of providing correct 
output by any unit. The system success probability always 
increases in the total number of voting units, the defender- 
attacker resource ratio, and the probability that each voting unit 
produces a correct output. The system success probability 
increases in the attacker-defender contest intensity if the defen- 
der achieves per-unit resource superiority, and otherwise 
decreases in the contest intensity. 

The presented model and enumerative algorithm allow obtain- 
ing optimal voting system defense strategy for any combination 
of parameters: total number of units, attack and defense 
resources, unit success probability and contest intensity. 

Future research can consider uneven resource distribution 
among the attacked and protected units. 
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